# CVE-2026-40618: F5 BIG-IP TMM denial of service in SSL profile processing

Source: https://junglewise.ai/threats/cve-2026-40618-f5-big-ip-tmm-denial-of-service-in-ssl-profile-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-40618 · Severity: high · CVSS 7.5 · Published 2026-05-13

A vulnerability in F5 BIG-IP networking devices can allow an attacker to crash the system's core traffic processing engine. This affects devices configured to handle secure (SSL) web traffic when certain hardware acceleration features are missing or disabled. An exploit would result in a complete service outage, preventing legitimate users from accessing applications protected by the BIG-IP system.

Technologies: [F5 BIG-IP](https://junglewise.ai/threats/technologies/big-ip). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-40618 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40618 being exploited in the wild.

**How severe is CVE-2026-40618?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** F5 Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Advanced WAF 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IP All versions without Intel QAT support; and 2 more.

**Is there a fix for CVE-2026-40618?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40618 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40618?** Check whether you run F5 Access Policy Manager, F5 Advanced Firewall Manager, F5 Advanced WAF or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in the F5 BIG-IP Traffic Management Microkernel (TMM). The issue occurs when an SSL profile is configured on a virtual server and the system is either a Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or a hardware platform with 'crypto.hwacceleration' disabled. An unauthenticated remote attacker can send specific, undisclosed network traffic that triggers an incorrect calculation of buffer size (CWE-131), leading to a TMM crash. This results in a restart of the traffic processing services and a temporary loss of availability. Fixed versions include updates to the 16.x and 17.x branches.

## Affected products

- F5 BIG-IP Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
- F5 BIG-IP Advanced WAF 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0

## Timeline

- 2026-05-13: advisory: Initial publication of the vulnerability advisory.

## References

- [https://my.f5.com/manage/s/article/K000158082](https://my.f5.com/manage/s/article/K000158082)

## Related threats

- [F5 BIG-IP privilege escalation in TMUI](https://junglewise.ai/threats/cve-2026-66842-f5-big-ip-privilege-escalation-in-tmui)
- [F5 BIG-IP Configuration utility error message spoofing](https://junglewise.ai/threats/cve-2026-63020-f5-big-ip-configuration-utility-error-message-spoofing)
- [F5 BIG-IP denial of service in HTTP/2 profile memory management](https://junglewise.ai/threats/cve-2026-59762-f5-big-ip-denial-of-service-in-http-2-profile-memory-management)
- [F5 BIG-IP and BIG-IQ incorrect permission assignment in tmsh and iControl REST](https://junglewise.ai/threats/cve-2026-42937-f5-big-ip-and-big-iq-incorrect-permission-assignment-in-tmsh-and)
- [F5 BIG-IP Appliance mode restriction bypass via path traversal](https://junglewise.ai/threats/cve-2026-42930-f5-big-ip-appliance-mode-restriction-bypass-via-path-traversal)